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Abstract 

Strong resilience properties of dynamical flow networks are analyzed for distributed routing policies. 
The latter are characterized by the property that the way the inflow at a non-destination node gets split 
among its outgoing Unks is allowed to depend only on local information about the current particle 
densities on the outgoing Unks. The strong resiUence of the network is defined as the infimum sum 
of Unk-wise flow capacity reductions under which the network cannot maintain the asymptotic total 
inflow to the destination node to be equal to the inflow at the origin. A class of distributed routing 
poUcies that are locaUy responsive to local information is shown to yield the maximum possible strong 
resilience imder such local information constraints for an acyclic dynamical flow network with a single 
origin-destination pair. The maximal strong resiUence achievable is shown to be equal to the minimum 
node residual capacity of the network. The latter depends on the Umit flow of the unperturbed network 
and is defined as the minimum, among all the non-destination nodes, of the sum, over aU the links 
outgoing from the node, of the differences between the maximum flow capacity and the Umit flow of the 
unperturbed network. We propose a simple convex optimization problem to solve for equilibrium limit 
flows of the unperturbed network that minimize average delay subject to strong resilience guarantees, 
and discuss the use of tolls to induce such an equilibrium limit flow in transportation networks. Finally, 
we present iUustrative simulations to discuss the connection between cascaded failures and the resiUence 
properties of the network. 
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Index terms: dynamical flow networks, distributed routing policies, strong resilience, price 
of anarchy, cascaded failures. 

I. Introduction 

Robustness of routing policies for flow networks is a central problem which is gaining 
increased attention with a growing awareness to safeguard critical infrastructure networks against 
natural and man-induced disruptions. Information constraints limit the efficiency and resilience of 
such routing policies, and the possibility of cascaded failures through the network adds serious 
challenges to this problem. The difficulty is further magnified by the presence of dynamical 
effects [2]. 

This paper considers the framework of dynamical flow networks introduced in our companion 
paper [3], where the network is modeled by a system of ordinary differential equations derived 
from mass conservation laws on directed acyclic graphs with a single origin-destination pair 
and a constant inflow at the origin. The rate of change of the particle density on each link of 
the network equals the difference between the inflow and the outflow on that link. The latter is 
modeled to depend on the current particle density on that link through a flow function. We focus 
on distributed routing policies whereby the proportion of incoming flow routed to the outgoing 
Unks of a node is allowed to depend only on local information, consisting of the current particle 
densities on the outgoing links of the same node. We call the dynamical flow network /w/Zy 
transferring if the outflow at the destination node asymptotically approaches the inflow at the 
origin node. Our primary objective in this paper is to analyze the robustness of distributed 
routing policies in terms of the network's strong resilience, which is defined as the infimum sum 
of link-wise magnitude of disturbances making the perturbed dynamical flow network not fully 
transferring. 

We prove that the maximum possible strong resilience is yielded by a class of locally re- 
sponsive distributed routing policies, introduced in the companion paper [3]. Such policies are 
characterized by the property that the portion of its inflow that a node routes towards an outgoing 
link does not decrease as the particle density on any other outgoing link increases. We show that 

the strong resilience of a dynamical flow network with such locally responsive distributed routing 
policies equals the minimum node residual capacity. The latter is defined as the minimum, among 
all the non-destination nodes, of the sum of the difference between the maximum flow capacity 
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and the limit flow of the unperturbed network, on all the links outgoing from the node. Using 
idea from [4], one can show that, when the information constraints on the routing policies are 
relaxed, i.e., the routing policies can access information about the particle densities over the whole 
network, then the strong resilience of the network is equal to the network residual capacity. The 
latter is defined as the difference between the min-cut capacity of the network and rate of arrival 
at the origin node. Since the minimum node residual capacity is in general less than the network 
residual capacity, this shows that the information constraints on the routing policies reduce the 
strong resilience of the network. Moreover, the minimum residual capacity depends on the limit 
flow of the unperturbed network. This is in stark contrast to our result on weak resilience in [3], 
where we showed that the weak resilience is unaffected by local information constraints on the 
routing policies and is independent of the limit flow of the unperturbed network. We also propose 
a simple convex optimization problem to solve for equilibrium limit flows of the unperturbed 
network that minimize average delay subject to strong resilience guarantees, and discuss the use 
of tolls to induce such an equilibrium limit flow in transportation networks. These results are 
derived under the condition when the link-wise flow functions are strictly increasing and the 
links have unbounded capacity for flow densities. We present illustrative simulations discussing 
cascaded failures that arise when the links have finite capacities on flows as well as densities. 
It is noteworthy that, we not only describe cascaded failures within a dynamical flow network 
framework and formaUze their effect by establishing the connection to our notions of network 
resilience, but also highhght the role of distributed routing policies in averting such failures. 

Stability analysis of network flow control policies under various routing policies is carried out 
in [5], [6], [7]. A detailed comparison between the settings of these papers and our dynamical flow 
network setting is included in the companion paper [3]. This paper also studies the connection 
between the robustness properties of the network and its equilibrium flow. The role of equilibrium 
in the efficiency of a system, especially in economic settings involving multiple agents, has 
attracted a lot of attention, e.g., see [8]. One of the most celebrated notions to measure the 
inefficiency of an equilibrium is the price of anarchy [9]. In a transportation setting, the price 
of anarchy of a given network state quantifies the extent to which the average delay faced by 
a driver at that state exceeds the least possible average delay over all network states. In this 
paper, we propose a robustness-based metric for measuring inefficiency of equilibrium states 
of dynamical flow networks. Finally, the study of cascaded failure for complex networks has 
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attracted a great deal of attention recently, e.g., see [10], [11] where the authors propose various 
models to explain this phenomenon. 

The contributions of this paper are as follows: (i) we formulate the notion of strong resilience 
of a dynamical flow network, and show that the class of locally responsive routing policies yield 
the maximum strong resilience under local information constraint; (ii) we formulate a simple 
convex optimization problem to solve for the most robust equilibrium flow, and discuss the use 
of tolls in implementing such an equilibrium in transportation networks; and (iii) we present 
illustrative simulations to discuss cascaded failures in dynamical flow networks and their effect 
on network resilience. 

The rest of the paper is organized as follows. In Section II, we briefly summarize the dynamical 
flow network framework and the postulate the notion of strong resilience. In Section III, we 
state the main result on the strong resilience, and provide discussions on the results. Section IV 
discusses the problem of selection of the most strongly resiUent equilibrium flow of the network 
and the use of tolls to induce such an equiUbrium in transportation networks. In Section V, we 
report illustrative numerical simulation results, discussing the effect of cascading failures on the 
resilience of the network. We conclude in Section VI with remarks on future research directions 
and state proofs of the main results in the appendices A and B. 

Before proceeding, we define some preliminary notation to be used throughout the paper. Let 
R be the set of real numbers, R+ := {x e R : x > 0} be the set of nonnegative real numbers. 
Let A and B be finite sets. Then, |^| will denote the cardinality of A, R"^ (respectively, R;;:^) 
the space of real-valued (nonnegative-real-valued) vectors whose components are indexed by 
elements of A, and R-^^'^ the space of matrices whose real entries indexed by pairs of elements 
in ^ X ^. The transpose of a matrix M e R-^^^, will be denoted by e R®^-^, while 1 
the all-one vector, whose size will be clear from the context. Let cl(A') be the closure of a set 
X C R-^. A directed multigraph is the pair (V, S) of a finite set V of nodes, and of a multiset 
£ of links consisting of ordered pairs of nodes (i.e., we allow for parallel links). Given a a 
multigraph {V,£), for every node v e V, we shall denote by C E, and S~ C £, the set 
of its outgoing and incoming links, respectively. Moreover, we shall use the shorthand notation 
TZ,^ := R^" for the set of nonnegative-real-valued vectors whose entries are indexed by elements 
of (St, := {p e TZv : Ylie&s+Pe = 1} for the simplex of probability vectors over and 
TZ :— R^ for the set of nonnegative-real-valued vectors whose entries are indexed by the Unks 
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in E. 



II. Dynamical flow networks 



The notion of dynamical flow network was introduced in the companion paper [3]. In order 
to render the present paper self-contained, we introduce here the concepts and notation which 
are most relevant. We start with the following definition of a flow network. 

Definition 1 (Flow network): A flow network N — (T, jj) is the pair of a topology, described 
by a finite directed multigraph T = (V, S), where V is the node set and £ is the link multiset, 
and a family of flow fiinctions ji :— {jie '■ — > K+}ee£: describing the functional dependence 
fe = /^e(Pe) of the flow on the density of particles on every link e e The_^ow capacity of a 
link e e £ is 



We shall use the notation := [0, Z™") for the set of admissible flow vectors on 

outgoing links from node and F := Xee^lO, Z™") for the set of admissible flow vectors for 
the network. We shall write / := {fe ■ e e £} G and p := {pe : e e £} G TZ, for the 
vectors of flows and of densities, respectively, on the different links. The notation :— {/g : 
e e £^} E Tv, and p" :— {pe : e E £:^} E TZv will stand for the vectors of flows and densities, 
respectively, on the outgoing links of a node v. We shall compactly denote by / = and 
f" — p^{p") the functional relationships between density and flow vectors. 

Throughout this paper, we shall restrict ourselves to flow networks satisfying the following 
assumptions. 

Assumption 1: The topology T contains no cycles, has a unique origin (i.e., a node v e V 
such that £~ is empty), and a unique destination (i.e., a node v eV such that £^ is empty). 
Moreover, there exists a path in T to the destination node from every other node in V. 

Assumption 2: For every link e G the map /ig : M+ M+ is continuously differentiable, 
strictly increasing, such that )Ue(0) = 0, and /^^^ < +oo. 

In particular. Assumption 1 implies that (see, e.g., [12]) one can identify (in a possibly non- 
unique way) the node set V with the integer set {0, 1, ... , n}, where n := \V\ — 1, in such a 
way that 



•max 



sup Pe{Pe) ■ 
Pe>0 



(1) 




= 0, . . . , n . 



(2) 



January 18, 2013 



DRAFT 



6 



In particular, (2) implies that is the origin node, and n the destination node in the network 
topology T. An origin-destination cut (see, e.g., [13]) of T is a partition of V into U and V\h( 
such that e U and n e V \ U. Let = {{u,v) e S : u e U,v e V \ U} he the set of all 
the links pointing from some node in U to some node mV\U. The min-cut capacity of a flow 
network M is defined as 



where the minimization runs over all the origin-destination cuts of T. Throughout this paper, 
we shall assume a constant inflow Aq > at the origin node. Let us define the set of admissible 
equilibrium flows associated to Aq as 



Then, it follows from the max-flow min-cut theorem (see, e.g., [13]), that J^*(Ao) 7^ whenever 
Ao < C{H). That is, the min-cut capacity equals the maximum flow that can pass from the 
origin to the destination while satisfying capacity constraints on the links, and conservation of 
mass at the intermediate nodes. 

We now recall the notion of a distributed routing policy from [3]. 

Definition 2 (Distributed routing policy): A distributed routing policy for a flow network M 
is a family of functions Q :— {G^ : TZ^ — > <S^}o<i;<n describing the ratio in which the particle 
flow incoming in each non-destination node v gets split among its outgoing link set S:^, as a 
function of the observed current particle density p" on the outgoing links themselves. 

The saUent feature of Definition 2 is that the routing policy G'"{p^) depends only on the local 
information on the particle density p'" on the set of outgoing links of the non-destination 
node V. 

We now state the definition of a dynamical flow networks and its transfer efficiency. 

Definition 3 (Dynamical fiow network and its transfer efficiency): A dynamical fiow network 
associated to a flow network J\f satisfying Assumption 1, a distributed routing policy Q, and an 
inflow Ao > 0, is the dynamical system 




(3) 



^p^{t) = X,{t)Gl{p\t))-f,{t), 



VO<v<n, Vee£+, 



(4) 



January 18, 2013 



DRAFT 



where 

I Ao if ^; = 

m := i^eiPeit)) , X,{t):={ (5) 

( Eeee.- fe(t) if 0<v<n. 

Given some flow vector f° G J^, the dynamical flow network (4) is said to he fully transferring 

with respect to f° if the solution of (4) with initial condition p(0) = iJi~^{f°) satisfies 

lim A„(t) = Ao . (6) 

t— >+oo 

Definition 3 states that a dynamical flow network is fully transferring when the outflow is 
asymptotically equal to the inflow, i.e., there is no throughput loss asymptotically. Observe that 
a fully transferring dynamical flow network does not necessarily imply that the link-wise flows 
necessarily converge to an equilibrium, for it might in principle have a persistently oscillatory or 
more complex behavior. Nevertheless, it will prove useful to introduce the notions of equilibrium 
and limit flow as follows. 

Definition 4 (Equilibrium and limit flow of a dynamical flow network): An equilibrium flow 
for the dynamical flow network (4) is a vector /* e ^*(Ao) such that 

KGlip^ = /: , Ve e C , VO < ^; < n , (7) 

where pi := /Xg ^(/*), and A* = Aq for v = and A* = Zleeg- ft for < < n. 

A limit flow for the dynamical flow network (4) is a vector /* e cl(J^) such that the solution of 

(4) with initial condition p(0) = A*~^(/°) satisfies 

lini/(t) = r. (8) 

t— >-+oo 

The set of all initial flows f°eT such that (8) is satisfied will be referred to as the basin of 
attraction of /*, and denoted by B{f*). 

Remark 1: Observe that an equilibrium flow /* e J^*(Ao) is always a limit flow, since the 
solution of the dynamical flow network (4) with initial flow f° — f* stays put for all t > 0, 
and hence it is trivially convergent to /*. On the other hand, if a limit flow /* e cl(J^) satisfies 
all the capacity constraints with strict inequality, i.e., if /* G J-', then necessarily /* G J-'*(Ao) 
is also an equilibrium flow for (4), i.e., it satisfies mass conservation equations at all the non- 
destination nodes. In particular, if a dynamical flow network admits an equilibrium flow /*, then 
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it is necessarily fully transferring with respect to /*, as well as with respect to all the initial 

flows r e Bin. 

In contrast, if /* G cl(J^) \ J^, i.e., if at least one of the capacity constraints is satisfied 
with equality, then /* is not an equilibrium flow for (4). In fact, in this case one has that 
Yleest ^ K with possibly strict inequality for some non-destination node Q <v <n. Hence, 
the dynamical flow network might still be non fully transferring. Finally, observe that a limit 
flow /* e cl(J^) (and, a fortiori, an equilibrium flow) may not exist for general flow networks 
J\f, and distributed routing policies Q. 

Remark 2: Standard definitions in the Uterature are typically limited to static flow networks 
describing the particle flow at equiUbrium via conservation of mass. In fact, they usually consist 
(see e.g., [13]) in the specification of a topology T, a vector of flow capacities e TZ, and 
an admissible equilibrium flow vector /* e J^(Ao) for Aq < C{M) (or, often, /* e cl(J"*(Ao)) 
for Ao < C{M)). 

In contrast, in our model we focus on the off-equilibrium particle dynamics on a flow network 
J\f, induced by a distributed routing policy Q. Existence of an equilibrium of the dynamical flow 
network (4) depends on the topology T, the structural form of the flow functions ji and of 
the distributed routing poHcy Q, as well as on the inflow Aq. A necessary condition for that is 
Ao < C{M). In contrast, simple, locally verifiable, sufficient conditions on Q for the existence of 
an equilibrium flow might be hard to find for complex flow networks. However, in some cases, it 
is reasonable to assume the distributed routing policy Q to be the outcome of a slow time-scale 
evolutionary dynamics with global feedback which can naturally lead to an equilibrium flow 
/* e J^*(Ao). This has been shown, e.g., in our related work [4] on transportation networks, 
where the emergence of Wardrop equilibria is proven using tools from singular perturbation 
theory and evolutionary dynamics. Multiple time-scale dynamics leading to Wardrop equilibria 
has been studied in [14] for communication networks. 

While, as discussed in Remark 2, finding simple, locally verifiable, sufficient conditions on the 
distributed routing policy Q for the existence of an equilibrium flow of the associated dynamical 
flow network (4) is typically nontrivial, a large class of distributed routing policies was proven to 
yield existence and uniqueness of a globally attractive limit flow /* e c\{T), as revised below. 

Definition 5 (Locally responsive distributed routing policy): A locally responsive distributed 
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routing policy for a flow network topology T = (V, E) with node set V = {0, 1, . . . , n} is a 
family of continuously differentiable distributed routing functions Q = {G" : TZy 5^}i,ev such 
that, for every non-destination node < v < n: 

(a) Aq(p-)>o, Vj,eeS:,j^e,p^ en,; 

(b) for every nonempty proper subset J C E^, there exists a continuously differentiable 
map G'^ : TZj — > Sj, where TZj :— R^, and Sj :— {p e TZj : J2jejPj ~ ^} ^^'^ 
simplex of probability vectors over J, such that, for every eTZj, if 

then 

g:(p^)^o, yeeS+\j, G]{p)^Gf{p^), Wjej. 
Let us restate the result proven in [3, Theorem 1]. 

Theorem 1 (Existence of a globally attractive limit flow under locally responsive routing policies): 
Let A/" be a flow network satisfying Assumptions 1 and 2, Aq > a constant inflow, and Q a 
locally responsive distributed routing policy. Then, there exists a unique limit flow /* e cl(J^) 
such that = T. Moreover, if /* = f^^ for some e e and < i; < n, then f* = f^^, 
for every e e E^. 

We shall use the above result in the form of the following corollary, which is an immediate 
consequence of Theorem 1 and Remarks 1 and 2. 

Corollary 1: Let be a flow network satisfying Assumptions 1 and 2, Aq > a constant 
inflow, and Q a locally responsive distributed routing policy. If the limit flow /* belongs to T, 
then /* e J^*(Ao) is a globally attractive equilibrium flow for the dynamical network flow (4), 
and, consequently, (4) is fully transferring with respect to /*. 

Example 1 (Locally responsive distributed routing policy): Let A/" be a flow network satisfy- 
ing Assumptions 1 and 2, and < Aq < C{N) a constant incoming flow. For /* = p{p*) € 
J^*(Ao), and ?7 > 0, define the distributed routing policy Q by 

Ge(p) = 7i 7 7 svv , Ve e , VO < i; < n . (9) 

^j^st fj ^M-v{Pj - Pj)) 

Then, Q can be easily verified to be locally responsive, and /* to be the globally attractive limit 
flow of the associated dynamical flow network (4). 
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III. Strong resilience of dynamical flow networks 

In this section, we shall introduce the notion of strong resilience of a dynamical flow network, 
and show that locally responsive policies are maximally robust among the class of distributed 
routing policies. We shall also provide an explicit simple characterization of the maximal strong 
resilience of a dynamical flow network with respect to a given Umit flow. 

We shall consider persistent perturbations of the dynamical flow network (4) that reduce the 
flow functions on the links, as per the following: 

Definition 6 (Admissible perturbation): An admissible perturbation of a flow network M = 
(T, yu), satisfying Assumptions 1 and 2, is a flow network J\f = {T,jl), with the same topology 
T, and a family of perturbed flow functions jj, :— {jle : M+ M+}ee£, such that, for every 
e E S, fie satisfies Assumption 2, as well as 

We accordingly let := sup{/Je(Pe) : Pe > 0}. The magnitude of an admissible perturbation 
is defined as 

5 := Se, 5e := sup iHeiPe) - Pe{pe) ■ Pe>^} ■ (10) 

Given a dynamical flow network as in Definition 3, and an admissible perturbation as in 
Definition 6, we shall consider the perturbed dynamical flow network 

^^p^{t) = K{t)Gl{~p''{t))-Ut), VO<^<n, Vee£+, (11) 

where 

I T..^r- feit) if 0<v<n 
I Ao if v = 0. 

We are now ready to define the notion of strong resilience of a dynamical flow network as in 
Definition 3 with respect to a limit flow /*. 

Definition 7 ( Strong resilience of a dynamical flow network): Let Af he a flow network satis- 
fying Assumptions 1 and 2, Aq > be a constant inflow at the origin, and Q a distributed routing 
policy. Assume that the corresponding dynamical flow network has a limit flow /* G cl(J^). The 
strong resilience yi{f*, G) is equal to the infimum magnitude of all the admissible perturbations 
for which the perturbed dynamical flow network (11) is not fully transferring with respect to 
some initial flow f° e B{f*). 
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Fig. 1. The network topology used in Example 2. 



Note that the notion of strong resilience formalized in Definition 7 is with respect to the worst- 
case scenario. Accordingly, one can provide an adversarial interpretation to the perturbations as 
in [3]. Our first result is an upper bound on the strong resilience of a dynamical flow network 
driven by an arbitrary distributed routing policy. In order to state such result, for a flow network 
M, and a flow vector /* G cl(J-'), define the minimum node residual capacity as 

R{M, n := min {j^ (/^ - Q ] • (13) 

0<v<n K^—^e^SJ ) 

Theorem 2 (Upper bound on the strong resilience): Let A/" be a flow network satisfying As- 
sumptions 1 and 2, Ao > a constant inflow, and Q any distributed routing policy. Assume that 
the associated dynamical flow network has a limit flow /* G J-'*(Ao). Then, 

iiU'\<3)<R{J^Jl- 

Proof: See Appendix A. ■ 

The proof of Theorem 2 essentially depends only on Assumption 1 on the acyclicity of the 
network topology. However, in order to show that the upper bound in Theorem 2 is tight for 
locally responsive policies, we have to rely highly on Properties (a) and (b) of Definition 5. The 
following example illustrates the necessity of these properties. 

Example 2: Consider the topology illustrated in Figure 1, with Aq = 2, flow functions given 

by 

/ie(Pe)=/e"'''(l-eXp(-aePe)) (14) 

with ai = as = 03 = 04 = 1 and Z™" = /g^"" = 2, /,7'' = Z^^" = 0.75. First consider the case 
when Gl^{p^) = 1 - = 0.75, and Gl.^{p^) = 1 - Gl^{p^) = 0.5. One can verify that the 
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associated dynamical flow network has a unique equilibrium flow /* with /^^ = 1.5, /^^ = 0.5, 
and f*,^ = f*,^ = 0.25. Now, consider an admissible perturbation such that jlei = 0.7/iei and 
flek = /^Cfc for k = 2,3, 4. The magnitude of such perturbation is 5 = 6ej = 0.6. It is easy to see 
that in this case \imt^^ feA^) = 1-4 = Z™'^'' which is less than 1.5, which is the flow routed to 
it. Therefore, lim(_^oo ^2(^) — 1-9 < Aq, and hence the network is not fully transferring. 

Now, consider the same (unperturbed) flow network as before, but with distributed routing 
policies such that 

G%{p') = 1-G°^(p°) = 2e-°-°3iPn/(2e-o.o3iPe,+g0.7i96pe,) ^ ^^i^^^i) ^ l-Gl{p') = 0.5. 

One can verify that the associated dynamical flow network again admits the same /* as before as 
an equilibrium flow. Let us consider the same admissible perturbation as before. One can verify 
that, for the corresponding perturbed dynamical flow network, limt^oo /ei(^) = 0.4 < f^^^ = 1.4 
and lim^^oo /e2(^) = 1-6 < Z™^"" = 2. However, with an asymptotic arrival rate of 1.6 at node 
1, we have that limt-^^ fe,{t) = 0.75 = and limt-^^ fe,{t) = 0.75 = Therefore, 

limt_^oo ^2{t) = 1.9 < Ao, and hence the network is not fully transferring. 

In both the cases, R{J\f,f*) — 1 and a disturbance of magnitude 0.6 is enough to ensure 
that the perturbed dynamical flow network is not fully transferring. However, note that in the 
second case, unlike the first case, the routing policy at node responds to variations in the local 
flow densities by sending more flow to link 62, but it is overly responsive in the sense that it 
sends more flow downstream than the cumulative flow capacity of the links outgoing from node 
1. However, by Definition 2, a distributed routing policy is not allowed any information about 
any other link other than the current flow densities of its outgoing links. This illustrates one 
of the challenges in designing distributed routing policies which yield R{N', /*) as the strong 
resilience. Observe that this distributed routing policy is not locally responsive, since used 
in the first case, does not satisfy Property (b) of Definition 5 and, in the second case, it does 
not satisfy Properties (a) and (b). 

We now state the main technical result of this paper, showing that, for locally responsive 
distributed routing function, the strong resilience coincides with the minimal residual node 
capacity. 

Theorem 3 (Strong resilience for locally responsive policies): Let A/" be a flow network sat- 
isfying Assumptions 1 and 2, Aq > a constant inflow, and Q a locally responsive distributed 
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Fig. 2. Comparison between a node-cut and a min-cut of a flow network. 



routing policy. Let /* e cl(J^) be the globally attractive limit flow of the associated dynamical 
flow network (4). Then, 



For a given flow network M, a constant inflow Aq, Theorem 2 and Theorem 3 imply that, 
among all distributed routing policies such that the dynamical flow network has a given limit 
flow /* e c\{T), locally responsive policies (for which such limit flow is unique and globally 
attractive by Theorem 1) have the maximum strong resilience. Moreover, such maximal strong 
resilience coincides with the minimum node residual capacity R{N' , /*), and hence it depends 
both on the flow network M, and on the limit flow /* of the unperturbed network. 

A few remarks are in order. First, it is worth comparing the maximum strong resilience of a 
dynamical flow network with its maximum weak resilience. The latter was studied in [3] and 
was shown (see Definition 6, Proposition 1, and Theorem 2 therein) to be equal to the min-cut 
capacity of the flow network, C{M). Clearly, the former cannot exceed the latter, as can be also 
directly verified from the definitions (13) and (3): for this, it is sufficient to consider (see Figure 



Proof: See Appendix B. 



2) 



U* e 




V 
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Fig. 3. (a) A parallel link topology, (b) A topology to illustrate arbitrarily large C{N) — R{M, /*). 

and observe that, since C and J2ee£+ fe — by conservation of mass, one has 

RiAf, n < E (/e"'" - /e ) < E - /:) = E - = ^(■^) - • 

eee+ e&£+, ee£+^ 

We provide below two examples to illustrate the difference between the two quantities. 

Example 3: For parallel link topologies, an example of which is illustrated in Figure 3 (a), 
one has that 

Example 4: Consider the topology shown in Figure 3 (b) with Aq = 1, /* = [e, 1 — e, e, 1 — e] 
and = [1/e, 1, 1/e, 1] for some e G (0, 1). In this case, we have that C{J\f) = 1 + 1/e and 
R[M, n = e. Therefore, 

CiAf)-RiAfJ*) = l + l/e-e, 
and hence C{N') — R{N', /*) grows unbounded as e vanishes. 

We conclude this section with the following observation. Using arguments along the lines 
of those employed in [4], one can show that C{J\f) — Aq provides an upper bound on the 
strong resilience even if the locality constraint on the information used by the routing policies is 
removed, i.e., if one allows C" to depend on the full vector of current densities p, rather than on 
the local density vector only. Indeed, one might exhibit routing policies which are functions 
of the global density information p, for which the strong resilience is exactly C{J\f) — Aq using 
ideas developed in the paper [4]. Hence, one may interpret the gap C{Af) — Aq — R{Af,f*) 
as the strong resilience loss due to the locality constraint on the information available to the 
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distributed routing policies. One could use Example 4 to again demonstrate arbitrarily large such 
loss due to the locality constraint on the information available to the routing policies. In fact, it 
is possible to consider intermediate levels of information available to the routing policies, which 
interpolate between the one-hop information of our current modeling of the distributed routing 
policies, and the global information described above. These results on the strong resilience are in 
stark contrast to our result on weak resilience in [3], where we showed that the weak resiUence 
is unaffected by local information constraints on the routing policies. 

IV. Robust equilibrium selection 

In this section, for a given flow network M satisfying Assumptions 1 and 2, a constant inflow 
Ao e [0, C(j\/')), and locally responsive distributed routing policies with limit flow /*, we shall 
address the issue of optimizing the strong resiUence of the associated dynamical flow network, 
R{N, /*) with respect to /*. First, in Section IV-A, we shall address the issue of maximizing 
R{f*) '■— /*) over all admissible equilibrium flow vectors /* e J'*(Ao), i.e., with the only 
constraints given by the link capacities and the conservation of mass. Then, in Section IV-B we 
shall focus on the transportation network case, and address the problem of implementing a desired 
/*, assuming that /* satisfies the additional constraint of being an equilibrium influenced by 
some static tolls. In Section IV-C, we shall evaluate the gap between the maximum of R{f*) 
over all /*, and a generic equilibrium /*, and interpret it as the robustness price of anarchy with 
respect to /*. We then distinguish between R{f*) and the commonly used metric of average 
delay associated to /*, and then propose a convex optimization problem to solve for /* that 
takes into account average delay as well as strong resilience. 

A. Robust equilibrium flow selection as an optimization problem 

The robust equilibrium flow selection problem can be posed as an optimization problem as 
follows: 

R*:^ sup i?(r), (15) 

/*e.F*(Ao) 

where we recall that J^(Ao) is the set of admissible equilibrium flow vectors corresponding 
to the inflow Aq G [0,C(A/^)). Equation (13) implies that R{f) is the minimum of a set of 
functions linear in /*, and hence is concave in /*. Since the closure of the constraint set J^*(Ao) 
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is a polytope, we get that the optimization problem stated in (15) is equivalent to a simple convex 
optimization problem. However, note that the objective function, is non-smooth and one 

needs to use sub-gradient techniques, e.g., see [15], for finding the optimal solution. 

B. Using tolls for equilibrium implementation in transportation networks 

We now study the use of static tolls to influence the decisions of the drivers in order to get a 
desired emergent equilibrium condition for (unperturbed) transportation networks. The static tolls 
affect the driver decisions over a slower time scale at which the drivers update their preferences 
for global paths through the network. These global decisions are complemented by the fast- 
scale node- wise route choice decisions characterized by Definition 2 and 5. The details of the 
analysis of transportation networks with such two time-scale driver decisions can be found in our 
companion paper [4]. In particular, we show that when the time scales are sufficiently separated 
apart, then the network densities are attracted to a neighborhood of Wardrop equilibrium. In this 
section, in order to highlight the relationship between static tolls and the resultant equilibrium 
point, we assume that the fast scale dynamics equilibrates quickly and focus only on the slow 
scale dynamics. 

We briefly describe the congestion game framework for transportation networks to formalize 
the equilibrium corresponding to the slow scale driver decision dynamics. Let T e 7?. be the 
link-wise vector of tolls, with Te denoting the toll on link e. Assuming that T is rescaled in 
such a way that one unit of toll corresponds to a unit amount of delay, the utility of a driver 
associated with link e when the flow on it is /e is — (Te(/e) + Te), where T'e(/e) is the delay 
on link e when the flow on it is /g. In order to formally describe the functions Te(/e), we shall 
assume that each flow function /ig satisfies Assumption 2, and additionally is strictly concave 
and satisfies /ie(0) < -l-oo. Observe that the flow function described in Example 14 satisfies 
these additional assumptions. Since the flow on a link is the product of speed and density on 
that link, one can define the link- wise delay functions Te{fe) by 

+ 00 if /e > 

Teife) I f^-\fe)/fe if fe G (0, fr), Ve G S. (16) 

if fe = 0, 

v 

Let V be the set of distinct paths from node to node n. The utility associated with a path 
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peVh- Ee6» (^e (/e) + Te). Let T(/) = {T^{Q : B & E} the vector of Unk-wise delay 



functions. We are now ready to define a toll-induced equilibrium. 

Definition 8 (Toll-induced equilibrium): For a given T G 7^, a toll-induced equilibrium is a 
vector /*(T) e J^* that satisfies the following for all p e P: 



Note that, /*(0) corresponds to a Wardrop equilibrium, e.g., see [16], [17], where is a vector 
all of whose entries are zero. For brevity in notation, we shall denote the Wardrop equilibrium by 
The following result guarantees the existence and uniqueness of a toll-induced equilibrium. 
Proposition 1 (Existence and uniqueness of toll-induced equilibrium): Let A/" be a flow net- 
work satisfying Assumptions 1 and 2 and Aq e [0, C{N)) a constant inflow. Assume additionally 
that the flow function jif. is strictly concave and satisfies /Xg(0) < -l-oo for every link e E E. 
Then, for every toll vector T e TZ, there exists a unique toll-induced equilibrium /*(T) e T*. 

Proof: It follows from Assumption 2, strict concavity and the assumption //g(0) < -|-oo 
on the flow functions that, for all e G £, the delay function Te{fe), as defined by (16), is 
continuous, strictly increasing, and is such that T'e(O) > 0. The Proposition then follows by 
applying Theorems 2.4 and 2.5 from [18]. ■ 

In this subsection, to illustrate the proof of concept, we will focus on equilibrium flows /* 
each of whose components is strictly positive. The results for a generic /* G follow 
along similar lines. Let A G {0, 1}^^^ be the path-link incidence matrix, i.e., for dXX e E 8 and 
p E V, Ap^e = 1 if e G p and zero otherwise. Definition 8 implies that for /*(T) G TZ, with 
/*(T) > for all e G to be the toll-induced equilibrium corresponding to the toll vector 
T G 7^ is equivalent to A (r(/*(T)) + T) = ul, for some u > 0. We shall use this fact in the 
next result, where we compute tolls to get a desired equiUbrium. 

Proposition 2 (Tolls for desired equilibrium): Let jV be a flow network satisfying Assump- 
tions 1 and 2 and Aq G [0, C{J\f )) a constant inflow. Assume additionally that the flow function 
/i-e is strictly concave and satisfies fi'^iO) < +oo for every link e E £. Assume that the Wardrop 
equilibrium is such that > for all eES. Let /* G J^*(Ao), with /* > for all e E S, 
be the desired toll-induced equiUbrium flow vector. Define T(/) ETZhy 



fe>0 \feEp 



J2 (Te ife) + Te) < J] {T, (/e) + T^) Vg G V. 





(17) 



January 18, 2013 



DRAFT 



18 



Then /* is the desired toll-induced equilibrium associated to the toll vector T(/*). 

Proof: Since is the Wardrop equilibrium, corresponding to the toll vector T = 0, we 
have that 



for some vi > 0. For / to be the toll-induced equilibrium associated to the toll vector T e 7?., 
one needs to find > such that 



Using (18) and simple algebra, one can verify that (19) is satisfied with T(/*) as defined in 



Remark 3: The toll vector yielding a desired equilibrium operating condition is not unique. 



In fact, any toll of the form T(/*) = cT{D - T{f), with c > max{Te{f*)/T^{f]^) : e e S} 



will induce / as the toll-induced equilibrium. Proposition 2 gives just one such toll vector. 

C. The robustness price of anarchy 

Conventionally, transportation networks have been viewed as static flow networks, where a 
given equilibrium traffic flow is the outcome of driver's selfish behavior in response to the delays 
associated with various paths and the incentive mechanisms in place. The price of anarchy [9] 
has been suggested as a metric to measure how sub-optimal a given equilibrium is with respect 
to the societal optimal equilibrium, where the societal optimality is related to the average delay 
faced by a driver. In the context of robustness analysis of transportation networks, it is natural 
to consider societal optimality from the robustness point of view, thereby motivating a notion 
of the robustness price of anarchy. Formally, for a /* e J^*(Ao), define the robustness price of 
anarchy as P (/*) := R* — R (/*). It is worth noting that, for a parallel topology, we have 
that R* = R (/*) = J2e(^£ ~ ^0 for all /*. That is, the strong resilience is independent of 
the equilibrium operating condition and hence, for a parallel topology, P (/*) = 0. However, 
for a general topology and a general equilibrium, this quantity is non-zero. This can be easily 
justified, for example, for robustness price of anarchy with respect to the Wardrop equilibrium: 
a Wardrop equiUbrium is determined by the delay functions Te(/e) as well as the topology of 
the network, whereas the maximizer of R{f*) depends only on the topology and the link-wise 



(18) 



A{T{f*) + T)^U2l. 



(19) 
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flow capacities of the network, as implied by the optimization problem in (15). In fact, as the 
following example illustrates, for a non-parallel topology, the robustness price of anarchy with 

respect to Wardrop equilibrium can be arbitrarily large. 

Example 5 (Arbitrarily large robustness price of anarchy with respect to Wardrop equilibrium): 
Consider the network topology shown in Figure 1. Let the link- wise flow functions be given by 
Equation (14). The delay function is then given by T^i^) = (ae/e"^)~\ T^ife) = log(l - 
/e//--) for /, e (0,/,"-') and T,{Q = +oo for > Fix some e e (0,1) and let 

Ao = 1/e. Let the parameters of the flow functions be given by J^'^" = Z™^" = 1/e + e, 
/eT = /eT = V(2e) + e/2, a^ = 1, a2 = = a, = {^) log (f±j) / log (^). For 
these values of the parameters, one can verify that the unique Wardrop equilibrium is given by 
= [1 1/e - 1 l/(2e) - 1/2 l/(2e) - 1/2]^. The strong resilience of is then given 
by R{J\f, /*) = min{2/e + 2e - 1/e, 1/e + e - (1/e - 1)} = 1 + e. One can also verify that, 
for this case, R* — l/e + 2e which would correspond to /* = [1/e 0]^. Therefore, 
P(/W) ^ 1/e + 2e - (1 + e) = 1/e + e - 1 which tends to +oo as e ^ 0+. 

The above example provides a strong motivation to take robustness into account while selecting 
the equilibrium operating condition for the network. However, conventionally, the equilibrium 
selection problem for transportation networks has been primarily motivated from the point-of- 
view of minimizing average delay. The average delay associated with an equilibrium /* is defined 
as: 

D(n:^J2f*eTeif*e)/^0. (20) 

The following simple example illustrates that the maximizers of —D{f*) and R{f*) are not 
necessarily the same. 

Example 6: Consider the network topology shown in Figure 1. Let the link- wise flow functions 
be given by Equation (14). Let the parameters of the flow function be given by: = 0.01, 
ae, = = = 10 and = = 2, = = 0.75. Let Aq = 2. The 

equilibrium maximizing R{f*) is /* = [2 0]^ and the maximum strong resilience is 
found to be R* = 1.5. The minimum value of D{f*) over all /* e J^*(Ao) is 15.17, and the 
corresponding equilibrium /* and the value of strong resilience are [0.5 1.5 0.75 0.75]^ and 
0.5 respectively. Note that the maximizers of —D{f*) and R{f*) are not necessarily the same. 
Therefore, a reasonable optimization problem should take into account average delay as well as 
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Fig. 4. Plots of the solution of the optimization in (21) for parameters specified in Example 6, as b is increased from to 
R* = 1.5: (a) /j* is the flow on link ei corresponding to /* optimizing (21); note that /2 — Aq — /i, and /J = /I = /2/2, 
(b) D* is the solution of (21). 



network resilience. Accordingly, we propose a modified optimization problem as follows: 

minimize D{f*) 

subj. to r e J^*(Ao), (21) 

Rin > b, 

where b E [0, R*]. Assumption 2 and Equation (20) imply that D{f*) is convex. Therefore, taking 
into account the expression for R{f*), (21) is still a convex optimization problem. Figure 4 plots 
the outcome of this optimization as b is varied from to R*. In all the cases, we solved (21) 
using CVX, a package for specifying and solving convex programs [19]. 

V. Cascaded failures 

In this section, through numerical experiments, we study the case when the flow functions are 
set to the ones commonly accepted in the transportation literature, e.g., see [20]. In transportation 
literature, the flow functions are defined over a finite interval of the form [0,^™^"], where p"^" 
is the maximum traffic density that link e can handle. Additionally, fi^ is assumed to be strictly 
concave and achieves its maximum in (0,/)™^"). For example, consider the following: 

/^e(Pe) = ^^^^p^^, PeG[0,pn- (22) 
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An important implication of the finite capacity on the traffic densities is the possibiUty of cascaded 
spill-backs traveling upstream as follows. When the density on a link reaches its capacity, its 
outflow permanently becomes zero and hence the link is effectively cut out from the network. 
When all the outgoing links from a particular node are cut out, it makes the outflow on all the 
incoming links to that node zero. Eventually, these upstream links might possibly reach their 
capacity on the density and cutting themselves off permanently and cascading the effect further 
upstream. We shall show how such cascaded effects possibly reduce the resilience. 

Another important differentiating feature of the flow functions given by (22) with respect to 
the flow functions satisfying Assumption 2 is that the flow functions corresponding to (22) are 
not strictly increasing. As a result, one cannot readily claim that the locally responsive distributed 
routing poUcies are maximally robust for this case. However, we illustrate via simulations that, 
with additional assumptions, the locally responsive distributed routing poUcies considered in this 
paper could possibly be maximally robust. In these simulations, we also study the effect of the 
flow functions given by (22) on the weak resilience of the network, which was formally defined 
in [3]. In simple words, weak resilience of the network is defined as the infimum sum of the 
link-wise magnitude of all the disturbances under which the outflow from the destination node is 
asymptotically zero. In [3, Proposition 1], we showed that the weak resilience of the dynamical 
flow network with the flow functions satisfying Assumption 2 is upper bounded by its min-cut 
capacity. It is easy to show that this upper bound on weak resilience also holds when the flow 
functions are the ones given by (22). 

For the simulations, we selected the following parameters: 

• the graph topology T shown in Figure 5. 

• Ao = 3. 

. let p^^ = 3 for all e e 8, and flow capacities given by f^^ = f^^ = f^^ = 2.5, 
= 0.9, = 1.75, = /-f = = 1, = = 0.7, = 0.4, 
/^^ax ^ jmax ^ 5^ jmax ^ 3, and = 1.6. The link-wise flow functions are as given in 
(22), if e e or if p < for at least one downstream edge e', i.e., e' & E such that 
e & S~ and e' e for some ^;e{l,...,n — 1}, and the flow functions are uniformly 
zero otherwise; 

. the equilibrium flow /* has components fl^ = f*^ = f*^ = 0.5, f*^ = 2, f*^ = f*^^ = 0.3, 

= /; = /; = 0.25, /; = 0.2, = = 0.9, = 0.2, f;^^ = 0.3, = 1.1, 
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Fig. 5. The graph topology used in simulations. 

and = 0.7; 
• the route choice function is as follows: 

' ^ J2je£+ fj exp(-r/(Pi - p*)) l[o,p--] [pj] ' 
where r] will be a variable parameter for the simulations. Note that this is a modified version 
of the route choice function given by (9). The modification is done to respect the finite traffic 
density constraint on the links. 
One can verify that, with these parameters, the minimum node residual capacity, and hence 
an upper bound on the strong resilience, as defined by (13) is 0.75. One can also verify that the 
maximum flow capacity of the network, and hence an upper bound on the weak resilience, is 
5.2. 

A. Effect of 7] on the strong resilience 

Consider an admissible perturbation such that pe^^ = ^Peio ^nd fie^ = Pk for all k E 
{1, . . . , 15} \ {10}. As a resuk, 5^,^ = 0.7 and 4^ = for all e {1, . . . , 15} \ {10}. Therefore, 
the magnitude of the perturbation is 5 = 0.7. Note that this value is less than the minimum 
node residual capacity of the network. We found that limf^oo ^esi^) = for all i] < 0.25, and 
limt_>oo -^68 (^) = Aq = 3 for all 7] > 0.25. The role of r] in the strong resilience is best understood 
by concentrating on a parallel topology consisting of edges eio and eu with arrival rate A*^. 
Using similar techniques as in the proof of Theorem 3, one can show the existence of a new 
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equilibrium for this local system. However, this equiUbrium is not attractive from a configuration 
where at least one of pe^^ or pe^a is at pf^^"^ or pf^^^, respectively. For 77 < 0.25, reaches 
Pelir' whereas for i] > 0.25, neither pen, nor pei2 hit the maximum density capacity and the 
system is attracted towards the new equiUbrium. 

B. Effect of cascaded shutdowns on the weak resilience 

Consider an admissible disturbance such that /ie4 = |A*e4> /^es = %l^es, ft^ee — |a*6> f^ev — ^l^er, 

f^es = f /^eg, f^eg = \peg, Pdo = |/^eiO' /^eia = ^/^eij and Pk = P'k for /c = { 1, 2, 3, 1 1 , 13, 14, 15}. 

As result, S^, = 0.7, S^, = 0.6, S,, = 0.2, S,, = 0.5, S^, = 0.5, 6,, = 0.2, S^,, = 0.6, S^,, = 0.7 
and 5efe = for /c = {1,2,3, 11, 13, 14, 15}. Therefore, 5 = 4, which is less than the min-cut 
flow capacity of the network. For this case, it is observed that, limt_^oo (t) — independent 
of the value of rj. This can be explained as follows. For the given disturbance, we have that 
fZT+fZT = < 1-8 = /eio+/ei2- Therefore, after finite time h, we have that p^M = p^^ 
and penit) = pf^^ for all i > ti. As a consequence, we have that, feSf) ~ and fe^t) = 
for all t > ti. One can repeat this argument to conclude that, for the given disturbance, after 
finite time, pe^. for k = 1, . . . ,9 reach and remain at their maximum density capacities. As a 
consequence, after such a finite time, fe^ (t) + /eg (t) + fes (t) — and hence, Umt_^oo {t) — 0, 
i.e., the network is not partially transferring. This is also illustrated in Figure 6 which plots the 
flow through some of the links of the network as a function of time. This example illustrates that 
the cascaded effects can potentially reduce the weak resilience of a dynamical flow network. 

VI. Conclusion 

In this paper, we studied strong resilience of dynamical flow networks, with respect to 
perturbations that reduce the flow functions of the links of the network. We showed that locally 
responsive distributed routing poUcies yield the maximum strong resilience under local informa- 
tion constraint. We also showed that the corresponding strong resilience is equal to the minimum 
node residual capacity of the network, and hence depends on the limit flow of the unperturbed 
network. Our results show that, unlike the weak resilience which was considered in [3], the 
strong resilience of a dynamical flow network is sensitive to local information constraint. We 
proposed simple convex optimization problems to solve for equilibria that maximize traditional 
metrics of social optimaUty such as average delay subject to guarantees on strong resilience. We 
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Fig. 6. Plot of link-wise flows for some of the links of the network that ultimately shut down. The timings of shut downs of 
the links demonstrate the cascaded effect starting from link eio and traveling up to the origin node. 



also discussed the use of tolls to induce a generic equilibrium flow for the unperturbed system in 
the context of transportation networks. Finally, we also discussed cascaded failures due to spill 
backs when we impose finite density constraints on the links and illustrated the utility of routing 
policies discussed in this paper in averting such failures. The findings of this and the companion 
paper [3] stand to provide important guidelines for management of several large scale critical 
infrastructures both from planning as well as real-time operation point of view. 

In future, we plan to extend the research in several directions. We plan to rigorously study 
the robustness properties of the network with finite link-wise capacity for the densities, and 
formally establish the results on the resilience as suggested in Section V. We plan to study the 
scaling of the resilience with respect to the amount of information, e.g., multi-hop as opposed 
to just single-hop, available to the routing policies. We also plan to perform robustness analysis 
in a probabilistic framework to complement the adversarial framework of this paper, possibly 
considering other general models for disturbances. In particular, it would be interesting to study 
robustness with respect to sequential disturbances than just one-shot disturbance considered in 
this paper. We plan to consider a setting with buffer capacities on the nodes and study the 
scaling of the resilience with such buffer capacities. We also plan to consider more general 
graph topologies, e.g., graphs having cycles and multiple origin-destination pairs. 
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Appendix A 
Proof of Theorem 2 

In this section, we shall prove Theorem 2 by showing that, given a flow network M satisfying 
Assumptions 1 and 2, a constant inflow Aq > 0, a distributed routing policy Q, and a limit flow 
/* e cl(J^) for the associated dynamical flow network (4), the strong resilience satisfies 

7i(r,^) = i?(A/',r). 

Let f° e be some initial flow attracted by /*. In order to prove the result it is sufficient 

to exhibit a family of admissible perturbations, with magnitude 5 arbitrarily close to R{N, /*), 
under which the network is not fully transferring with respect to f°. Let us fix some non- 
destination node < V < n minimizing the right-hand side of (13), and put k :— Yl:e&s+ fT'^^- 
For any f*) < 5 < k, consider the admissible perturbation defined by 

^ ^ 

fieiPe) := l^e(Pe) , Ve G £:+ , fie(pe) P'e(pe) , ^6 E S \ E:^ . (23) 

Clearly, the magnitude of such perturbation equals 6. 

Let us consider the origin-destination cut-set W := {0, 1, . . . , v}, and put 

:— {{u, w) & £ : < u < v,v < w < n} . 

Observe that, thanks to Assumption 1 on the acyclicity of the network topology, since all 
the edges outgoing from some node m < f are unaffected by the perturbation, the associated 
perturbed dynamical flow network (11) with initial flow /(O) — f° e B{f*) satisfies 

lim /e(t)= lim /e(t) = /:, Vee£:+, \JQ<u<v. 

t— >+oo I— >+oo 

In particular, this implies that jjLe{Pe{t)) = fl for all t > 0, and for every link e e \ On 
the other hand, one has that 

K 

Therefore, one has that 

^ 1"^ — ^ /-max I 
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Observe that, for every v < w < n, and t >0, 
Define the edge sets 

Un—l , I in 

and put C{t) := X^ee^ Using (25), the identity AUS^ = 1), and (24), one gets that there 
exists some r' > such that 

lew = E , < E - E , < E 
- E,^/^w-E,.-/eW-E,^/e(t) 

= E - E /^w 

< i?(AA,r) -5 + Ao-A„(t)+£, 
for all t >t'. Now assume, by contradiction, that 

liminf ~X^{t) > R{J\f, f)-6 + Xo. 

Then, there would exist some £ > and r" > such that 

~Xn{t) > R{Af, r)-5 + Xo + 2e, t>T". 

It would then follow from (26) and Gron wall's inequality that 

< C(t) - - t)£ , Vi>T, 

where r := max{r',r"}. Then, ^(t) would converge to — oo as t grows large, contradicting the 
fact that C,{t) > for all t > 0. Hence, necessarily 

lim inf \n{t) < R{Af, /*) - 5 + Ao < Ao , 

so that the perturbed dynamical flow network is not fully transferring. Then, from the arbitrariness 
of the perturbation's magnitude 5 e {R{J^, /*), n), it follows that the network's strong resiUence 
is upper bounded by R{N', /*). 
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Appendix B 
Proof of Theorem 3 

In this section, we shall prove Theorem 3, by showing that, given a flow network M satisfying 
Assumptions 1 and 2, a constant inflow Aq > 0, and a locally responsive distributed routing poUcy 
Q, then the strong resiUence of the unique Umit flow /* e cl(J^) of the associated dynamical 
flow network (4) satisfies 

7i(r,^) = i?(Ar,r). 

Thanks to Theorem 2, it is sufficient to show that 

li{f\Q)>R{J^J*)- (27) 

First, let us consider the case when /* e cl(J^) \ J^*(Ao), i.e., when the limit flow of the 
unperturbed dynamical flow network (4) is not an equilibrium. As argued in Remark 1, in this 

case some of the capacity constraints are satisfied with equality, i.e., there exist < f < n and 
e e such that fl = ^. Then, Theorem 1 implies that f; = /g'"^^ for all e G £+, so that 

Ri^f,n< E(/e""^-/e)=0, 

and (27) is trivially satisfied, since 7i(/*,^) > by definition. Therefore, for the rest of this 
section, we shall restrict ourselves on the case when /* e J^*(Ao), i.e., when /* is a globally 
attractive equilibrium flow of the unperturbed dynamical flow network (4). 

Observe that, for any admissible perturbation, regardless of its magnitude, the perturbed 
dynamical flow network (11) satisfies all the assumptions of Theorem 1, which can therefore 
be applied to show the existence of a globally attractive perturbed Umit flow /* e cl(J^). This 
in particular implies that A„(i) = Z^ees^ /e(^) converges to A* = J2ee£n ^ grows large. 

However, this is not sufficient in order to prove strong resilience of the perturbed dynamical 
flow network (11), as it might be the case that A* < Aq. 

In fact, it turns out that, if the magnitude of the admissible perturbation is smaller than 
i?(jV, /*), the perturbed limit flow /* is an equilibrium flow for the perturbed dynamical flow 
network, so that A* = Aq and (11) is fully transferring. In order to show this, we need to study 
the perturbed local system 

^Pe(t) = ~x{t)G:{~p%t)) - m , m = upeit)) , ve e c , (28) 
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for every non-destination node < v < n, and nonnegative-real-valued, Lipschitz continuous 
local input X{t). Indeed, [3, Lemma 4] can be applied to the perturbed local system (28) estab- 
lishing convergence of the perturbed local flows f'"{t) to a local equilibrium flow /*(A) G J-'v, 
provided that the input flow \{t) converges, as t grows large, to a value A which is strictly 
smaller than the sum of the perturbed flow capacities of the outgoing links. However, such local 
result is not sufficient to prove strong resilience of the entire perturbed dynamical flow network. 
The key property in order to prove such a global result is stated in Lemma 1, which describes 
how the flow redistributes itself upon the network perturbation. In particular, such result ensures 
that the increase in flow on all the links downstream from a node whose outgoing links are 
affected by a given perturbation, is less than the magnitude of the disturbance itself. We shall 
refer to this property as the diffusivity of the local perturbed system. 

Lemma 1 (Diffusivity of the local perturbed system): Let A/^ be a flow network satisfying As- 
sumptions 1 and 2, Q he a locally responsive distributed routing poUcy, Aq > a constant inflow. 
Assume that /* e J^*{Xo) is an equilibrium flow for the dynamical flow network (4). Let Af be 
an admissible perturbation of AA, < v < n be a nondestination node. A* := Xlee£•^t /e ' 
A G [0, J2ee€+ /f"")- Then, for every J C £+, the local equilibrium flow /*(A) of the perturbed 
local system (11) with constant local input X{t) = A satisfies 

E.,..(/;w-/:)s[a-a;],+x:^^^,5.. (29) 

where 6e := WM-) - M-)\\oo- 

Proof: Define A* := ^eee+ fe^ ^ niax{A,A*}. Let p'"{t) be the solution of the 
perturbed local system (28) with constant input X{t) = A, and initial condition Pe(0) = p* := 
IJ'~^{f*), for all e G and let /e(e) := jle{Pe{t))- We shall first prove that 

feit)>Upl). Vt>0 VeG£+. (30) 

For this, consider a point p'" G TZ^, such that p" ^ p*, and there exists some i ^ such that 

Pi = p* and pe > pI for all e 7^ i G £l^. For such a p" and i, [3, Lemma 4] implies that 
Grip") > G'^iP*)- This, combined with the fact that A > A; and 

Pi{Pi) < Pi{Pi) = Pi{p*i) , 

yields 

X^Glip^) - Uk) > XlG^dp) - Piipl) = . (31) 
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Considering the region Q :— {p^ e TZ^ : pj > p* , Vj e and denoting by a; e R^"^ the unit 
outward-pointing normal vector to the boundary of Q at p^, (31) shows that 

^p" • CO = (a^G"'(p") - p^(p^)) • u; < , Vp" e , t > . 

Therefore, O is invariant under (28). Since p^(0) = p* E ^l, this proves (30). 

Now, [3, Lemma 4] implies that there exists a unique local equilibrium flow /* := /*(A). 
Then, for any J" C £+, (30) implies that 

.Jj - ^v- z^^Jk 

= a: - a: + /; + p,{pi) - y, ^{pI) 
< [A:-A:]+ + E,/; + E/e, 

where the summation indices j, k, and e run over J, \ J, and respectively. Moreover, 
since A < A from [3, Lemma 3], one gets that /*(A) < /*(A) = f* for all e e In particular, 
this implies that 

jeJ jeJ 

This, combined with (32), proves (29). ■ 

The following lemma exploits the diffusivity property from Lemma 1 along with an induction 
argument on the topological ordering of the node set to prove that -R(j\A, /*) is indeed a lower 
bound on the strong resilience of the network under the locally responsive distributed routing 
policies. 

Lemma 2 (Globally attractive equilibrium for perturbed flow network): Consider a flow net- 
work J\f satisfying Assumptions 1 and 2, a locally responsive distributed routing policy Q, and 
a constant inflow Aq > 0. Assume that /* G J-'*(Ao) is an equilibrium flow for the associated 
dynamical flow network. Let jV" be an admissible perturbation of jV, of magnitude 5 < -R(j\A, /*). 
Then, the perturbed dynamical flow network (11) has a globally attractive equilibrium flow and 
hence it is fully transferring. 

Proof: First recall that Theorem 1 can be appUed to the perturbed dynamical network (11) 
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Fig. 7. Illustration of the sets used in proving the induction step. 



in order to prove existence of a globally attractive limit flow /* G cl(J-') for the perturbed 
dynamical network flow (11). For brevity in notation, for every 1 < v < n, put 



Also, for every node t> G V, let 



A! 



V^ =[ f , := {{u,w) e S : < u < V, V < w < n} 



n — 1: 



be, respectively, the set of all outgoing links, and the link-boundary of the node set {0, 1, . . . , f }. 
We shall prove the following through induction on u = 0, 1, . 

First, notice that Bq = Vq = 8^ . Since 



(33) 



we also have that Xq < X^^"^. Therefore, by using (29) of Lemma 1, one can verify that (33) 
holds true for t> = 0. 

Now, for some v < n — 2, assume that (33) holds true for every u < v. Consider a subset 
J ^ B^+i and let Ji := jr\S:^_^i and J2 := J\Ji (e.g., see Figure 7). By applying Lemma 1 
to the set Ji, one gets that 
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It is easy to check that J2 C By and f^^^^ C By. Therefore, using (33) for the sets J2 and 
J2 U one gets the following inequalities respectively: 

E.,^, (/.•-/:) 2 E.,,.*=. (35) 
E.,,. (/: - /;) - E.,.,^. (A- - /;) ^ E.,.. (36, 

Consider the two cases: A*+i < A*_j.i, or A*_|.i > A*+i. By adding up (34) and (35), in the first 
case, or (34) and (36) in the second case, one gets that 

E(/:-/:)-E(/e-/:) + E(/:-/:)< E'^^+E'^^^ E 

eGj" eejTi eGj2 eF£:+, , e^T^v eGl?u+i 

This proves (33) for node + 1 and hence the induction step. 

Fix \ <v<n. Since E~ C (33) with w = i> — 1 implies that 

a: = ea-£ E/;+ E ^' = E/.' + E*-- E 

where the third step follows from the fact that f* — Yleest conservation of mass. 

Then, since £^ C £ \ one gets that 

< E /:+mr)-E 

'e 'e 
'e 

E^max 

where the summation index e runs over Hence, it follows from [3, Lemma 2] applied to the 
perturbed local system (28) that 

f: = f:CK)<t^, Vee£+, (37) 

for all 1 < < n — 1. Moreover, since Aq = J^eest fe < Ylieest -^"^ ' ^PP^Y^^S t^' Lemma 2] 
again to the perturbed local system (28) shows that (37) holds true for = as well. Hence, 
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SO that the Umit flow /* belongs to T, and hence it is necessarily an equilibrium flow of the 
perturbed dynamical flow network (11), as argued in Remark 1. Therefore, the dynamical flow 
network (11) is fully transferring. ■ 

Theorem 3 now immediately follows from Lemma 2, and the arbitrariness of the admissible 
perturbation of magnitude smaller than R{M ., /*). 
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